CVE-2025-47906: Unexpected paths returned from LookPath in os/exec
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.24.6 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.23.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47906?
CVE-2025-47906 is classified as a medium severity vulnerability.
How do I fix CVE-2025-47906?
To mitigate CVE-2025-47906, ensure that the PATH environment variable contains only directory paths and exclude executable files.
Which versions of Google Go are affected by CVE-2025-47906?
CVE-2025-47906 affects Google Go versions up to 1.24.6 and 1.23.12.
What are the potential impacts of CVE-2025-47906?
If exploited, CVE-2025-47906 can lead to unexpected behavior when certain strings are passed to LookPath.
Is there a patch available for CVE-2025-47906?
Yes, upgrading to a version of Google Go beyond 1.24.6 or 1.23.12 will resolve the vulnerability.